API and agents
MCP server
Mesh is MCP-native. Your coding agent deploys, debugs, and manages your services through the Mesh MCP server; the console shows the same state.
"Deploy this repository with a Postgres database and give it a domain."
"Why is my api service crashing?"
"What did staging cost this month, and what would Pro unlock?"
Connect your agent
Paste this into Claude Code, Codex, Cursor, VS Code, or any agent that speaks MCP over streamable HTTP:
Please setup the mesh mcp: https://mesh.example.com/mcpThe console shows the exact prompt for your installation right after your first sign-in, and again under Connect agent in the top bar.
The agent adds the server and opens your browser. Sign in, choose
Connect, and you are done: no binary to install and no token to copy. If
your agent asks you to set it up yourself, the server is
https://mesh.example.com/mcp with HTTP transport, and the agent signs in
with OAuth on first use.
The connection appears under API tokens as a connected agent. It acts as you in every workspace you belong to, renews itself while in use, and stops after 30 days without use. Choose Disconnect to revoke it at once.
How agents work with Mesh
- Few tools up front. A session starts with the everyday tools, so it
stays small.
find_toolsfinds the rest,describe_toolshows their arguments, andrun_toolcalls them. - Changes are staged.
create_service,update_service,set_variables, andcreate_volumechange drafts. Tools that acceptrelease: truereturn a preview unlessconfirm: trueis also supplied; the preview makes no changes. Nothing runs untilrelease_environment. Most of these tools acceptrelease: trueto do both.scale_serviceis the exception and applies at once. - Destructive tools preview first. Deletes, releases, billing
cancellation, and deployment removal return a preview. The agent must show
it to you and call again with
confirm: trueafter you agree. - Debugging starts with evidence.
diagnose_servicegathers status, deployments, the latest build, recent logs, domains, and likely issues in one call. - Anything in a browser is a link. Connecting GitHub, adding a card, and upgrading return a URL for you to open. The agent then checks the result.
- Plans are explicit.
list_planslists every plan's price and limits. When a change hits a limit, the agent can tell you which plan lifts it, andstart_billing_activationreturns the upgrade link. - Secrets stay hidden.
list_variablesreturns names only, unless the agent asks for values and you may read them.
Tools
Always listed: whoami, list_projects, environment_status,
create_service_from_repository, release_environment, diagnose_service,
get_logs, and the discovery tools find_tools, describe_tool, and
run_tool. The rest are reached through discovery.
| Area | Tools |
|---|---|
| Account | whoami, get_workload_limits |
| Regions | list_regions, configure_region (operators) |
| API tokens | list_api_tokens, create_api_token, revoke_api_token |
| Workspaces | list_workspaces, get_workspace, create_workspace, rename_workspace, delete_workspace, list_workspace_members, invite_workspace_member, revoke_workspace_invitation, accept_workspace_invitation, decline_workspace_invitation, update_workspace_member_role, remove_workspace_member |
| Projects | list_projects, create_project, get_project, delete_project, restore_project, move_project, update_project_log_retention |
| Environments | list_environments, create_environment, get_environment, environment_status, rename_environment, duplicate_environment, set_environment_auto_deploy, delete_environment, restore_environment, release_environment |
| Services | list_services, get_service, get_service_status, create_service, update_service, remove_service, restore_service, duplicate_service, scale_service, discard_service_changes, list_deleted_resources |
| Variables | list_variables, set_variables |
| Deployments | list_deployments, redeploy, restart_service, rollback_deployment, deployment_action, list_build_attempts, list_service_artifacts |
| Domains | list_domains, domain_status, generate_domain, create_domain, update_domain, delete_domain, restore_domain |
| Volumes | list_volumes, get_volume, create_volume, update_volume, move_volume, delete_volume |
| Templates | list_templates, create_from_template |
| Observability | get_logs, get_build_logs, http_logs, service_metrics, diagnose_service |
| Fleet (operators) | get_fleet, enroll_fleet_agent, update_fleet_agent, set_fleet_agent_lifecycle |
| Plans and billing | list_plans, get_project_usage, get_workspace_usage, get_billing_account, list_billing_statements, get_billing_statement, update_billing_budget, change_billing_plan, start_billing_payment_setup, start_billing_activation, cancel_billing_account |
| GitHub and source | get_github_connection, connect_github, disconnect_github, list_github_repositories, list_github_branches, list_github_dockerfiles, create_service_from_repository, inspect_source, link_github_repository |
| Docs | docs_search, docs_fetch |
get_billing_account reports trial resource caps when the account's plan ID
is unknown; the original plan ID remains visible.
The server also offers two prompts, deploy_app and debug_deployment, and
every page of this guide as a platform://docs/… resource, so agents can read
the same documentation you do.
Safety
- Your agent should still ask before running tools. Mesh's confirmation step is a second line of defence, not a replacement.
- Everything the agent does is recorded as you: it appears in deployment history and the connection's last use under API tokens.
- Disconnect an agent you no longer use or trust.